Your files stay on your device

COEP checker

Fetches a page's Cross-Origin-Embedder-Policy header through the proxy and explains what it permits, the COEP without COOP gap, and which embedded resources need CORP or CORS.

Press the button to read the headers

Nothing leaves this page until you do. The report grades the Cross-Origin-Embedder-Policy header and its Report-Only twin, names what each value permits, and checks the COEP-without-COOP combination that costs everything and isolates nothing.

COEP exists for one payoff: a page that enforces require-corp or credentialless, with COOP same-origin beside it, becomes cross-origin isolated, which unlocks SharedArrayBuffer and higher-resolution timers in exchange for process-level sandboxing. The cost lands on subresources. Under require-corp, every cross-origin image, script, or frame without CORP or CORS headers stops loading; under credentialless it loads stripped of your credentials instead, which is why credentialless is the lower-breakage choice where Chromium's share of your audience allows it. A static header check cannot see those subresources, so this report states what the policy demands rather than what actually loaded. Deploy Cross-Origin-Embedder-Policy-Report-Only first, watch the reports, then enforce.

Was this tool useful?